d2960f644e438e178732c88c9a099def3d1004b7628a15357ef1407a1d23d70a

Analysis

max time kernel
140s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25007d4cb4df3743a3918620a7e14fa7_JaffaCakes118.exe
Size

20KB
MD5

25007d4cb4df3743a3918620a7e14fa7
SHA1

8f948a5bed0dd354bd87936efaf23e7a2a59a232
SHA256

d2960f644e438e178732c88c9a099def3d1004b7628a15357ef1407a1d23d70a
SHA512

9b003c5eca9d7a79d68cf35ad307a7a95ff1662baf886249265fca18fc60da6267b7d372d851586912ccea5599e2f55874c07385127871cb10b6d445645983cd
SSDEEP

384:9cd6w+NomiUBQZVoRiCKKtYh2pNvdAajICjDfLAqjC4l1GBGj0:qIomvQ7oTOUVAaMSEq2W1GAQ

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	25007d4cb4df3743a3918620a7e14fa7_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3908	lasma.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25007d4cb4df3743a3918620a7e14fa7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lasma.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 3908	828	25007d4cb4df3743a3918620a7e14fa7_JaffaCakes118.exe	85
PID 828 wrote to memory of 3908	828	25007d4cb4df3743a3918620a7e14fa7_JaffaCakes118.exe	85
PID 828 wrote to memory of 3908	828	25007d4cb4df3743a3918620a7e14fa7_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\25007d4cb4df3743a3918620a7e14fa7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25007d4cb4df3743a3918620a7e14fa7_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828
- C:\Users\Admin\AppData\Local\Temp\lasma.exe
  "C:\Users\Admin\AppData\Local\Temp\lasma.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lasma.exe

Filesize
20KB

MD5
5ae73ed76a0b0c32de9ef6f73ce8b35f

SHA1
6d562114c92a39251046b0810ab84a8b5c64f1e6

SHA256
7f8fad1d8a82be2b63043de95a6d358244c3ae992532b63bafa09918d0686e08

SHA512
a4f891e1beef39b81bc42a0f2d010877b44aea87f71395783334b4af9362a03753dbccaebc9109a259ac4fdb16823c5cc86a7430e659235d7af2f97df7533c76

Download Submit
memory/828-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/828-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download